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MEMORANDUM  FOR  AUDITOR  GENERAL.  DEPARTMENT  OF  THE  ARMY 

AUDITOR  GENERAL,  DEPARTMENT  OF  THE  NAVY 
AUDITOR  GENERAL.  DEPARTMENT  OF  THE  AIR  FORCE 

SUBJECT:  FY  2008  External  Reviews  of  the  Quality  Control  Systems  of  the  Military 
Department  Audit  Agencies  (Report  No.  D-2009-6-002) 

Section  8  (c)(6)  of  the  Inspector  General  Act  of  1978,  as  amended,  requires  the 
Inspector  General  of  the  Department  of  Defense  to  monitor  and  evaluate  the  adherence  of 
Department  auditors  to  internal  audit,  contract  audit,  and  internal  review  principles, 
policies,  and  procedures.  Government  Auditing  Standards  issued  by  the  Comptroller 
General  ol  the  United  States  require  that  organizations  conducting  Government  audits 
and/or  attestation  engagements  have  an  appropriate  internal  quality  control  system  in 
place  and  undergo  an  external  review  at  least  once  every  three  years  by  reviewers 
independent  of  the  audit  organization  being  reviewed. 


Results  of  the  Military  Department  Audit  Agencies  External  Reviews.  We  are 

issuing  an  unmodified  opinion  on  the  system  of  audit  quality  control  for  each  of  the 
Military  Department  audit  agencies  -  Army  Audit  Agency  (AAA),  Naval  Audit  Service 
(NAVAUDSVC),  and  the  Air  Force  Audit  Agency  (AFAA).  We  determined  that  the 
systems  ol  quality  control  for  each  of  the  Military  Department  audit  agencies  were 
suitably  designed  and  complied  with  to  provide  reasonable  assurance  that  the  AAA, 
NAVAUDSVC,  and  AE AA  conform  to  applicable  auditing  standards,  policies,  and 
procedures  in  the  conduct  of  their  work.  We  made  this  determination  based  on  our 
oversight  of  the  external  peer  reviews  conducted  by  the  Military  Department  audit 
agencies  of  each  other  and  our  quality  control  reviews  of  their  Special  Access  Program 
(SAP)  audits. 

Key  Observations  Noted  During  the  Review  Process.  Each  of  the  review  teams 
made  observations  and  suggested  actions  to  the  audit  agencies  to  strengthen  their  systems 
of  quality  control.  Although  not  affecting  the  overall  opinion  on  the  Military  Department 
audit  agencies’  quality  control  programs,  we  believe  that  the  Military  Department  audit 
agencies  should  give  particular  regard  to  the  following: 

Independence.  While  there  were  no  indications  of  external  or  personal 
impairments  to  independence,  each  of  the  Military  Department  audit  agencies'  non-SAP 
audit  quality  control  reviews  identified  improvements  needed  for  documentation  of 
independence  for  audit  personnel.  In  addition,  one  audit  agency's  SAP  quality  control 


review  also  identified  issues  with  documentation  of  independence.  Those  issues  included 
lack  of  documentation,  incomplete  documentation,  or  documentation  of  independence  of 
audit  staff  months  after  assignment  to  the  audit. 

Planning.  All  three  of  the  Military  Department  audit  agencies’  quality 
control  reviews  of  the  SAP  audits  addressed  areas  for  improvement  in  planning.  In 
addition  to  the  quality  control  reports  of  the  SAP  audits,  one  quality  control  report  of  the 
non-SAP  audits  also  identified  an  issue  with  planning.  Each  review  identified  specific 
areas  for  improvement  for  planning.  Those  improvements  included  not  preparing  audit 
and  survey  programs  at  the  beginning  of  each  phase  of  the  audit,  changes  made  to  the 
audit  program  without  evidence  of  supervisory  approval,  and  not  including  steps  for  the 
risk  assessment  for  fraud.  Recommendations  were  made  in  the  quality  control  reports  for 
auditors  to  comply  with  the  corresponding  internal  audit  policy  for  each  issue  identified. 

Supervision.  For  supervision,  each  of  the  Military  Department  audit 
agencies’  non-SAP  audit  quality  control  reviews  addressed  that  supervision  needed 
improvement.  In  addition,  one  SAP  audit  quality  control  review  also  identified  needed 
improvements  in  the  area  of  supervision.  Each  review  identified  specific  areas  for 
improvement  for  supervision.  Those  improvements  included  that  supervisory  reviews 
did  not  occur  timely  and  that  working  papers  did  not  contain  evidence  of  supervisory 
reviews.  While  the  policies  that  were  established  were  appropriate  to  implement  the 
Government  Auditing  Standards  for  supervision,  it  was  recommended  that  supervisors  be 
reminded  and  made  aware  of  the  requirements  and  the  importance  for  following  the 
policies. 


Reporting.  Each  of  the  Military  Department  audit  agencies’  non-SAP 
audit  quality  control  reviews  identified  areas  for  improvement  for  reporting.  Each  review 
identified  specific  improvements  for  reporting.  Some  of  those  improvements  included: 

•  clearly  state  why  the  audit  organization  undertook  the  audit, 

•  appropriately  mention  if  the  auditors  established  the  reliability  of  the  data, 

•  clearly  identify  an  evaluation  of  internal  controls,  and 

•  clearly  represent  management  comments. 
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Other  Issues.  While  not  all  the  reports  addressed  areas  for  improvement  in  the 
following  areas,  the  reports  identified  issues  with  quality  control,  competence,  and 
evidence  and  documentation.  For  each  of  these  areas,  the  reports  contained 
recommendations  or  suggestions  for  improvements  by  either  improving  internal  audit 
policies  or  having  managers  provide  reminders  to  comply  with  internal  audit  policies. 

Ensuring  Integrity  of  Audit  Documentation.  The  FY  2005  quality  control 
reviews  of  the  Military  Department  audit  agencies  identified  that  each  organization  had 
modifications  or  additions  to  audit  documentation  after  final  report  issuance.  None  of  the 
Military  Department  audit  agencies  identified  this  as  an  issue  in  the  FY  2008  quality 
control  reviews. 

External  Review  Process  and  Methodology.  The  Office  of  the  Assistant 
Inspector  General  for  Audit  Policy  and  Oversight  (OAIG-APO)  and  the  Military 
Department  audit  agencies  used  the  2005  President’s  Council  on  Integrity  and  Efficiency 
(PCIE)  External  Peer  Review  Guide  to  conduct  their  reviews  of  the  Military  Department 
audit  agencies  audits  operations  and  modified  the  guide  as  appropriate.  We  performed 
procedures  to  provide  a  basis  for  reliance  on  the  Military  Department  audit  agencies 
review  results  and  to  ensure  that  the  PCIE  guidelines  were  consistently  applied.  We 
attended  planning  meetings,  reviewed  point  papers  for  each  of  the  audits  selected,  and 
reviewed  previous  quality  control  reviews  for  implementation  of  suggested  actions  or 
recommendations . 

For  the  review  of  SAP  audits,  we  judgmentally  selected  up  to  three  SAP  audits 
from  each  Military  Department  audit  agency  to  review.  We  reviewed  the  SAP  audits 
using  the  guide  as  modified  to  ensure  consistency  with  the  Military  Department  audit 
agencies’  review  of  non-SAP  audits,  and  to  reflect  the  unique  nature  of  auditing  within  a 
SAP  environment. 

Limitations  of  Reviews.  The  external  reviews  of  the  quality  control  systems 
performed  by  the  Military  Department  audit  agencies  and  OAIG-APO  would  not 
necessarily  disclose  all  weaknesses  in  the  system  of  quality  control  or  all  instances  of 
noncompliance  with  it  because  the  reviews  were  based  on  selective  tests.  There  are 
inherent  limitations  in  considering  the  potential  effectiveness  of  any  quality  control 
system.  In  performing  most  control  procedures,  departures  can  result  from 
misunderstanding  of  instructions,  mistakes  of  judgment,  carelessness,  or  other  human 
factors.  Projecting  any  evaluation  of  a  quality  control  system  into  the  future  is  subject  to 
the  risk  that  one  or  more  procedures  may  become  inadequate  because  conditions  may 
change  or  the  degree  of  compliance  with  procedures  may  deteriorate. 
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The  external  peer  review  opinion  reports  from  the  Military  Department  audit 
agency  performing  the  reviews,  the  associated  Letters  of  Comments,  and  the  OAIG-APO 
reports  on  the  SAP  audits  for  each  of  the  Military  Department  audit  agencies  should  be 
considered  jointly  as  our  basis  for  supporting  an  overall  unqualified  opinion  on  their 
systems  of  audit  quality  control. 

If  you  have  any  questions,  please  contact  Robert  L.  Kienitz  at  (703  )  604-8754  or 
Robert ,  Kienitz@dod  ig.mil. 


Carolyn  R.  Davis 
Assistant  Inspector  General 
for  Audit  Policy  and  Oversight' 
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